Repository navigation
Isolate authenticated imports through the complete frame-closure caller - #2698
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This source-bound opt-in adapter gives the existing frame-closure verifier and all eight nested interpreters distinct fresh import-cache namespaces. A benign numeric-module regression establishes the parent/child consistency gap left explicitly outside #2553; it makes no invalid-certificate acceptance claim.
The unchanged caller still checks all six engine receipts, 6,477 closure entries, 1,156 assignments and nine inherited test groups, including its optimized-rejection grandchild. Only three exact subprocess callsites and one native-Windows input-path spelling are adapted in memory. All 15 original runtime files stay immutable and authenticated. Complete receipt and stdout-hash comparisons retain every field.
Validation: clean full native CPython 3.12.7 replay passed; all four controls also passed under an explicit fresh parent
-X pycache_prefixwith optimization (86.616s), including a complete Git-free export with prior numeric bytecode. Final registered primary and all four optimized control groups passed (79.515s for the controls). A separate OpenAI Codex reviewer checked the exact frozen caller and adapter, then independently passed all four optimized controls under an explicit fresh parent cache prefix (83.076s), including the full consumer and all nine inherited groups. All eight final Git files are bound in the review receipt.Pins: canonical base
b5ea56e0a5ac4552166253b1fa4be0753bb38c30, priority revision 5; unchanged scientific source from1884c509efc004524786e9b7cfcc4aca572316d5; predecessor #2553a82fea84445e54042fa56b39ff1509fa329fad93. Canonical claim. Latest source/main/comments and 30 PRs refreshed 17:32 UTC; earlier complete overlap coverage 817 PRs / 1,279 Discussion records retained in TASK.Limits: fixed normal adapter entrypoint and named caller tree. No custom-loader, race, arbitrary-descendant, repository-wide, selected-cold-replay, supplier or kappa claim. No performance result. Credit Ross Richardson's adapter, Seth Burkart's PR886 closure contract, the PR589/PR555 fixture lineage, and #2553's prior registered-parent isolation. Prepared for ywz65 with substantial OpenAI Codex assistance and separate agent review; no human or formal-kernel review claimed.